WaratekVRT Sign in

High Tika CVEs

7 CVEs, 1 exploited, 5 protected by Waratek

Reset
More filters (1)
Columns
Product tika✕
Overview 7 matches · 5 protected · 1 exploited · 0 CISA KEV · 2 public PoC · 1 EPSS ≥ 0.5
7matches 5protected71.4% 1exploited14.3% 0CISA KEV0.0% 2public PoC28.6% 1EPSS ≥ 0.514.3%
Protected by Waratek 5 71.4% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 2 28.6%
Critical 0 0.0% High 7 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 5 71.4% partly blocked 0 0.0% not blocked 2 28.6% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 14.3% Working exploit published 0 0.0% Proof of concept only 1 14.3% Forecast only 0 0.0% No public exploit 5 71.4%
split by peak 2 / quarter
No exploit published: 2Protected by Waratek: 5 High: 7 not blocked: 2blocked by ARMR today: 5 No public exploit: 5Proof of concept only: 1Exploited: 1
Q3 171 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 Q4 170 Q1 180 Q2 181 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1 Q3 181 Protected by Waratek1 High1 blocked by ARMR today1 Proof of concept only1 Q4 181 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 Q1 190 Q2 190 Q3 192 No exploit published2 High2 not blocked2 No public exploit2 Q4 190 Q1 200 Q2 200 Q3 200 Q4 200 Q1 210 Q2 211 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1
Q4 17Q2 18Q4 18Q2 19Q4 19Q2 20Q4 20Q2 21
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2021-33813 High 2021-06-16 Protected by Waratek No public exploit An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.
CVE-2019-10094 High 2019-08-02 No exploit published No public exploit A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Apache Tika users should upgrade to 1.22 or later.
CVE-2019-10088 High 2019-08-02 No exploit published No public exploit A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Users should upgrade to 1.22 or later.
CVE-2018-11796 High 2018-10-09 Protected by Waratek No public exploit In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after the first parse. Apache Tika versions from 0.1 to 1.19 are therefore still vulnerable to entity expansions which can lead to a denial of service attack. Users should upgrade to 1.19.1 or later.
CVE-2018-11761 High 2018-09-19 Protected by Waratek Proof of concept only In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
CVE-2018-1335 High 2018-04-25 Protected by Waratek Exploited From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.
CVE-2016-4434 High 2017-09-30 Protected by Waratek No public exploit Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity (XXE) attacks via vectors involving (1) spreadsheets in OOXML files and (2) XMP metadata in PDF and other file formats, a related issue to CVE-2016-2175.